CVE-2026-56705: Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

Q: What conditions are required for exploitation?

An attacker must be able to reach an affected Adminer instance and submit a crafted MSSQL server value. No authentication or user interaction is required; the attack injects ODBC parameters into the PDO DSN using semicolons.

Q: Which deployments are most exposed?

Adminer installations that support MSSQL connections and are reachable by unauthenticated users are exposed. The reported technique writes PHP code through injected TraceFile and TraceOn parameters and requires the resulting trace file to be accessed to obtain remote code execution.

Q: How can I determine whether my instance is affected?

Check the Adminer version in use. Versions before 5.4.3 are affected; version 5.4.3 or later is not identified as affected by the provided information.

Published Aug 25, 2026

Updated

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

Affected Software

1 affected component

Adminer Adminer<5.4.3

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to reach an affected Adminer instance and submit a crafted MSSQL server value. No authentication or user interaction is required; the attack injects ODBC parameters into the PDO DSN using semicolons.

Which deployments are most exposed?

Adminer installations that support MSSQL connections and are reachable by unauthenticated users are exposed. The reported technique writes PHP code through injected TraceFile and TraceOn parameters and requires the resulting trace file to be accessed to obtain remote code execution.

How can I determine whether my instance is affected?

Check the Adminer version in use. Versions before 5.4.3 are affected; version 5.4.3 or later is not identified as affected by the provided information.

CVE-2026-56705: Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments are most exposed?

How can I determine whether my instance is affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments are most exposed?

How can I determine whether my instance is affected?